[Openvpn-devel] [XS] Change in openvpn[master]: Correctly calculate packet id size when epoch packet format is in use
"cron2 \(Code Review\) via Openvpn-devel" <[email protected]> Wed, 29 Jul 2026 16:34:54 +0000
| Newsgroups | net.sourceforge.lists.openvpn-devel |
|---|---|
| Message-ID | <[email protected]> |
--===============0829230650855727397==
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
Content-Type: multipart/alternative; boundary="Yid799/ur6A="; charset=UTF-8
--Yid799/ur6A=
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
cron2 has submitted this change=2E ( http://gerrit=2Eopenvpn=2Enet/c/openvp=
n/+/1829?usp=3Demail )
Change subject: Correctly calculate packet id size =
when epoch packet format is in use
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E
Correctly calculate packet id size when epoch packet=
format is in use
The code assumed that always when tls mode (without CFB/=
OFB) is in use
that the packet size is 4 bytes=2E With epoch packet format =
is incorrect
as that uses 64 bit=2E
Even thought packet_id_long_form has a=
the same size (8 byte) it is not
the same header format (32 bit time + 32 =
bit IV) as the epoch
format (16 bit epoch + 48 IV)=2E Use a simple sizeof(u=
int64_t) to
avoid suggesting that it might be the same=2E
Github: closes O=
penVPN/openvpn#1074
Change-Id: I5b862eabe032eb4d2229ff5b2f4f6af7406f6f4e
S=
igned-off-by: Arne Schwabe <arne@rfc2549=2Eorg>
Acked-by: Antonio Quartulli=
<antonio@mandelbit=2Ecom>
Gerrit URL: https://gerrit=2Eopenvpn=2Enet/c/ope=
nvpn/+/1829
Message-Id: <20260729064158=2E15731-1-gert@greenie=2Emuc=2Ede>
=
URL: https://www=2Email-archive=2Ecom/openvpn-devel@lists=2Esourceforge=2En=
et/msg37983=2Ehtml
Signed-off-by: Gert Doering <gert@greenie=2Emuc=2Ede>
--=
-
M src/openvpn/mtu=2Ec
1 file changed, 8 insertions(+), 0 deletions(-)
=
diff --git a/src/openvpn/mtu=2Ec b/src/openvpn/mtu=2Ec
index e5db8ab=2E=2E=
f3c2874 100644
--- a/src/openvpn/mtu=2Ec
+++ b/src/openvpn/mtu=2Ec
@@ -35,6=
+35,7 @@
#include "crypto=2Eh"
#include "memdbg=2Eh"
+#include "ssl_co=
mmon=2Eh"
/* allocate a buffer for socket or tun layer */
void
@@ -51,6=
+52,13 @@
calc_packet_id_size_dc(const struct options *options, const str=
uct key_type *kt)
{
bool tlsmode =3D options->tls_server || options->=
tls_client;
+ bool epoch =3D options->imported_protocol_flags & CO_EPOCH=
_DATA_KEY_FORMAT;
+
+ /* epoch format uses a 64-bit packet id: 16 bit ep=
och + 48 bit per-epoch counter */
+ if (epoch)
+ {
+ return si=
zeof(uint64_t);
+ }
bool packet_id_long_form =3D !tlsmode || ciph=
er_kt_mode_ofb_cfb(kt->cipher);
--
To view, visit http://gerrit=2Eopenv=
pn=2Enet/c/openvpn/+/1829?usp=3Demail
To unsubscribe, or for help writing m=
ail filters, visit http://gerrit=2Eopenvpn=2Enet/settings?usp=3Demail
Gerr=
it-MessageType: merged
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit=
-Change-Id: I5b862eabe032eb4d2229ff5b2f4f6af7406f6f4e
Gerrit-Change-Number:=
1829
Gerrit-PatchSet: 3
Gerrit-Owner: plaisthos <arne-openvpn@rfc2549=2Eor=
g>
Gerrit-Reviewer: ordex <antonio@mandelbit=2Ecom>
Gerrit-CC: openvpn-deve=
l <openvpn-devel@lists=2Esourceforge=2Enet>
--Yid799/ur6A=
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html><html><head><style></style></head><body><p>cron2 <strong>sub=
mitted</strong> this change=2E</p><p><a href=3D"http://gerrit=2Eopenvpn=2En=
et/c/openvpn/+/1829?usp=3Demail">View Change</a></p><div style=3D"white-spa=
ce:pre-wrap"></div><pre class=3D"blocks" style=3D"font-family: monospace,mo=
nospace; white-space: pre-wrap;">Correctly calculate packet id size when ep=
och packet format is in use<br><br>The code assumed that always when tls mo=
de (without CFB/OFB) is in use<br>that the packet size is 4 bytes=2E With e=
poch packet format is incorrect<br>as that uses 64 bit=2E<br><br>Even thoug=
ht packet_id_long_form has a the same size (8 byte) it is not<br>the same h=
eader format (32 bit time + 32 bit IV) as the epoch<br>format (16 bit epoch=
+ 48 IV)=2E Use a simple sizeof(uint64_t) to<br>avoid suggesting that it m=
ight be the same=2E<br><br>Github: closes OpenVPN/openvpn#1074<br><br>Chang=
e-Id: I5b862eabe032eb4d2229ff5b2f4f6af7406f6f4e<br>Signed-off-by: Arne Schw=
abe <arne@rfc2549=2Eorg><br>Acked-by: Antonio Quartulli <antonio@m=
andelbit=2Ecom><br>Gerrit URL: https://gerrit=2Eopenvpn=2Enet/c/openvpn/=
+/1829<br>Message-Id: <20260729064158=2E15731-1-gert@greenie=2Emuc=2Ede&=
gt;<br>URL: https://www=2Email-archive=2Ecom/openvpn-devel@lists=2Esourcefo=
rge=2Enet/msg37983=2Ehtml<br>Signed-off-by: Gert Doering <gert@greenie=
=2Emuc=2Ede><br>---<br>M src/openvpn/mtu=2Ec<br>1 file changed, 8 insert=
ions(+), 0 deletions(-)<br><br></pre>
<pre style=3D"font-family: monospace,=
monospace; white-space: pre-wrap;"><span>diff --git a/src/openvpn/mtu=2Ec b=
/src/openvpn/mtu=2Ec</span><br><span>index e5db8ab=2E=2Ef3c2874 100644</spa=
n><br><span>--- a/src/openvpn/mtu=2Ec</span><br><span>+++ b/src/openvpn/mtu=
=2Ec</span><br><span>@@ -35,6 +35,7 @@</span><br><span> #include "cryp=
to=2Eh"</span><br><span> </span><br><span> #include "memdbg=2Eh&q=
uot;</span><br><span style=3D"color: hsl(120, 100%, 40%);">+#include "=
ssl_common=2Eh"</span><br><span> </span><br><span> /* allocate a buffe=
r for socket or tun layer */</span><br><span> void</span><br><span>@@ -51,6=
+52,13 @@</span><br><span> calc_packet_id_size_dc(const struct options *op=
tions, const struct key_type *kt)</span><br><span> {</span><br><span> b=
ool tlsmode =3D options->tls_server || options->tls_client;</span><br=
><span style=3D"color: hsl(120, 100%, 40%);">+ bool epoch =3D options-&g=
t;imported_protocol_flags & CO_EPOCH_DATA_KEY_FORMAT;</span><br><span s=
tyle=3D"color: hsl(120, 100%, 40%);">+</span><br><span style=3D"color: hsl(=
120, 100%, 40%);">+ /* epoch format uses a 64-bit packet id: 16 bit epoc=
h + 48 bit per-epoch counter */</span><br><span style=3D"color: hsl(120, 10=
0%, 40%);">+ if (epoch)</span><br><span style=3D"color: hsl(120, 100%, 4=
0%);">+ {</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ =
return sizeof(uint64_t);</span><br><span style=3D"color: hsl(120, 100%, 40=
%);">+ }</span><br><span> </span><br><span> bool packet_id_long_form=
=3D !tlsmode || cipher_kt_mode_ofb_cfb(kt->cipher);</span><br><span> </=
span><br><span></span><br></pre><p>To view, visit <a href=3D"http://gerrit=
=2Eopenvpn=2Enet/c/openvpn/+/1829?usp=3Demail">change 1829</a>=2E To unsubs=
cribe, or for help writing mail filters, visit <a href=3D"http://gerrit=2Eo=
penvpn=2Enet/settings?usp=3Demail">settings</a>=2E</p><div itemscope itemty=
pe=3D"http://schema=2Eorg/EmailMessage"><div itemscope itemprop=3D"action" =
itemtype=3D"http://schema=2Eorg/ViewAction"><link itemprop=3D"url" href=3D"=
http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1829?usp=3Demail"/><meta itemprop=
=3D"name" content=3D"View Change"/></div></div>
<div style=3D"display:none=
"> Gerrit-MessageType: merged </div>
<div style=3D"display:none"> Gerrit-Pr=
oject: openvpn </div>
<div style=3D"display:none"> Gerrit-Branch: master </=
div>
<div style=3D"display:none"> Gerrit-Change-Id: I5b862eabe032eb4d2229ff=
5b2f4f6af7406f6f4e </div>
<div style=3D"display:none"> Gerrit-Change-Number=
: 1829 </div>
<div style=3D"display:none"> Gerrit-PatchSet: 3 </div>
<div s=
tyle=3D"display:none"> Gerrit-Owner: plaisthos <arne-openvpn@rfc2549=2Eo=
rg> </div>
<div style=3D"display:none"> Gerrit-Reviewer: ordex <anton=
io@mandelbit=2Ecom> </div>
<div style=3D"display:none"> Gerrit-CC: openv=
pn-devel <openvpn-devel@lists=2Esourceforge=2Enet> </div>
</body></h=
tml>
--Yid799/ur6A=--
--===============0829230650855727397==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============0829230650855727397==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
--===============0829230650855727397==--